TR

Subdomain finder

List the hostnames of a domain that appear in public Certificate Transparency logs: a quick inventory of what has been given a TLS certificate.

wikipedia.orggithub.comcloudflare.commozilla.orgbbc.co.uk

Where the list comes from

Every publicly trusted TLS certificate is recorded in Certificate Transparency logs, open append-only ledgers that browsers require. The hostnames inside each certificate are therefore public. OrbitProbe searches those logs through crt.sh and collects the names that fall under the domain you entered.

That makes the list a record of certificates, not of DNS. A name can be listed and no longer exist; a name that only ever used a wildcard certificate, or none, will be missing. Wildcard entries such as *.example.com are shown separately because they cover names without revealing them.

What it is good for

Owners use it to find forgotten hosts: the staging site from three years ago, a test system a contractor set up, a certificate issued by someone who should not have been able to. It is also the quickest way to see that certificates are public, which is a reason not to put secrets into hostnames.

For your own domains, follow up each unfamiliar name with a DNS lookup to see whether it still resolves. Use the tool on domains you are responsible for or are authorised to assess.

FAQ

How can I find all subdomains of a domain?

There is no complete public list: DNS does not allow enumeration. Certificate Transparency logs are the best open source, and show every name that has had a public certificate.

Why is a subdomain I know about missing?

It probably never had its own public certificate: it may use a wildcard certificate, plain HTTP, or an internal certificate authority.

Does a listed subdomain still exist?

Not necessarily. The log keeps certificates forever. Run a DNS lookup on the name to see whether it resolves today.

Can I keep my subdomains out of these logs?

Not if they use publicly trusted certificates. A wildcard certificate hides individual names; an internal certificate authority avoids the logs but is only trusted by devices you manage.

Why did the search fail or time out?

The log search service is shared and sometimes slow, especially for domains with many certificates. A failed search is reported as a failure, never as "no subdomains". Try again after a minute.